Top Cybersecurity News Weekly Summary - Week of April 7th, 2025

Weekend Cybersecurity Roundup: Your Digest of Major Breaches, Threats, and Policy Shifts

Cloud & Data Breaches

Oracle’s Quiet Admission of a Cloud Breach
Threat actor Rose87168 claims to hold millions of Oracle Cloud records, including encrypted credentials for over 140,000 tenants. After initially denying any compromise, Oracle is now privately notifying certain customers of an eight-year-old legacy system breach. While trust in Oracle wavers, large-scale migrations away from its platform remain unlikely due to the costs and complexities involved.

WK Kellogg Data Theft Linked to Clop/Cleo Breach
American cereal producer WK Kellogg confirmed a late 2024 data theft tied to Clop ransomware exploits in Clio’s file transfer platform. Investigations reveal attackers accessed sensitive data as early as December, highlighting the widespread risks of vulnerable third-party systems—a risk reinforced by similar exploits at Western Alliance Bank.

Port of Seattle Discloses 90,000 Impacted
A long-awaited disclosure revealed that an August breach at Seattle-Tacoma International Airport compromised 90,000 individuals’ data, including partial Social Security numbers and birthdates. Operations were temporarily handled via whiteboards after passenger display systems went offline. Although payment details were spared, the incident underscores the importance of swift public notifications and airtight data protections.

Texas State Bar Ransomware Attack
A February ransomware assault on the Texas State Bar exposed thousands of records including driver’s licenses, credit card information, and unencrypted Social Security numbers. Regulators and the public question why such sensitive data lacked proper protection. The breach raises concerns over how legal and governmental organizations store and safeguard personally identifiable information (PII).

Oracle’s “Confusing” Follow-Up
Further communication from Oracle cites “obsolete servers” as the breach source, though many clients question inconsistencies in the company’s statements. Observers stress that transparent incident responses build trust—especially when high-value cloud services are at stake.

Attacks on Government & Critical Sectors

U.S. Treasury / OCC Breach
Attackers infiltrated the Office of the Comptroller of the Currency’s email system last June, compromising over 150,000 messages via an admin account. Discovered only in February, the protracted access showcases how advanced threats remain hidden for months, prompting calls for stricter administrative account oversight and intrusion detection.

Australian Super Fund Credential Storm
Multiple major superannuation funds (including one managing AUD 360 billion) were hit by large-scale credential stuffing attacks, impacting thousands of user accounts. Some members lost savings, pointing to weak or absent multifactor authentication. Critics argue governments overemphasize breach notifications while neglecting robust cybersecurity baselines.

NSA Director Fired Amid Speculation
Former President Trump abruptly dismissed NSA Director Timothy Haw—initially appointed under President Biden—triggering rumors of a broader agency reorganization. Despite media portrayals of turmoil, day-to-day NSA and Cyber Command operations remain stable. Congressional observers note the potential separation of NSA and U.S. Cyber Command in the future.

Russian Nation-State Actors Exploit RDP
A lesser-known Microsoft Remote Desktop Protocol feature allowed a Russian threat group (UNC-5837) to pivot from phishing emails into resource redirection and file theft on European government and military networks. Attackers used specially crafted RDP files, again highlighting the importance of restricting RDP usage and scrutinizing email attachments.

Phishing Campaigns in Ukraine
Continuing the Russia-Ukraine conflict in cyberspace, Ukrainian law enforcement warns of macro-enabled Excel files distributing novel malware like “gifted crook.” By leveraging highly localized phishing lures—such as demining efforts or UAV production—attackers maintain a high success rate. Security teams everywhere should assume such tactics could be adapted to other regions.

TikTok Granted an Additional 75-Day Extension
Despite ongoing national security debates, TikTok has 75 more days to finalize a deal that would allow continued U.S. operations. The extension points to the complex balance of addressing data-privacy risks while accommodating TikTok’s significant user base and business partnerships.

Ransomware & Criminal Actors

Everest Ransomware Gang Website Hacked
In a twist of “hacker vs. hacker,” the Everest gang’s dark web platform was defaced with the message “Don’t do crime, crime is bad,” forcing the site offline. It remains unclear who carried out the hack—rival cybercriminals, researchers, or hacktivists—showing that threat actors aren’t immune to being targeted themselves.

Ransomware Attack at Sensata Technologies
Global components manufacturer Sensata reported a ransomware breach to the SEC just days after the incident. Although details are evolving, early indications suggest proprietary data was stolen. Sensata’s rapid public disclosure aligns with new SEC guidelines and stresses how industrial and manufacturing entities remain prime ransomware targets.

Texas State Bar and Australian Super Funds
Both the Texas State Bar and Australian superannuation funds highlight the devastating overlap between ransomware or credential stuffing attacks and lack of adequate encryption or authentication controls. The common thread: even large institutions can have major defensive gaps, putting users’ data at risk.

Espionage & Nation-State Threats

Chinese Espionage Exploits Avanti VPN Appliances
UNC-5221, believed to be backed by China, leverages well-known flaws in Avanti Connect Secure VPN to install malware families “Trailblaze” and “Brushfire.” Avanti has repeatedly been a favorite target for state-sponsored actors, prompting many experts to advise replacing or heavily hardening Avanti gear.

Chinese Spyware Targets Uyghurs, Tibetans, and Taiwanese
Two spyware families—Moonshine and BadBazaar—impersonate legitimate communication or religious apps to exfiltrate messages, photos, and microphone data. These campaigns reflect China’s continued digital surveillance of dissident communities, illustrating how advanced spyware can hide in everyday mobile tools.

Russia Arrests CEO Linked to Disinformation
Authorities in Moscow detained the CEO of ASA Group, tied to a major “Doppelganger” disinformation campaign. Officially, charges revolve around drug trafficking and criminal organization leadership, though many experts suspect political theater—Russian state media rarely covers these cases objectively.

Software & Vulnerabilities

Critical Apache Parquet (CVE-2025-30065)
A perfect 10/10 deserialization flaw in the Apache Parquet Java library could let attackers fully compromise data-processing systems. Organizations using Parquet for analytics must urgently move to version 1.15.1 or higher, highlighting how a single open-source vulnerability can pose widespread risk.

Android Zero-Day Patches
Google rolled out April 2025 updates for actively exploited kernel vulnerabilities (CVE-2024-53150, -531907). Limited targeted attacks, possibly by spyware vendors, show again how zero-days quickly find real-world use. Amnesty International links some exploitation to European operations, underscoring the truly global nature of mobile threats.

CrushFTP Vulnerability Exploitation
Actively attacked since March, a newly cataloged CrushFTP flaw (CVE-2025-31161) allows remote compromise followed by pivoting with legitimate tools like AnyDesk or Mesh Agent. Rapid patching and vigilant logging remain key to thwarting such sophisticated infiltration methods.

Ivanti Connect Secure Hole
Roughly 5,000 internet-facing Ivanti (Pulse Secure) VPN appliances remain unpatched against CVE-2025-22457, a critical buffer overflow. While fixes have existed since February, many organizations lag behind—a risk magnified by repeated Chinese APT exploits of Ivanti’s offerings.

ESET Software Exploited by ToddyCat
An ESET vulnerability (CVE-2025-XXXXXX) facilitated malicious code execution within ESET’s own processes. Though rated “medium” by ESET (CVSS 6.8), some argue the real-world impact is severe. This highlights how even trusted antivirus software can become an attack vector if not swiftly patched.

Massive Enterprise Patches
Microsoft’s Patch Tuesday (134 flaws, one zero-day), Adobe’s 54 fixes for ColdFusion and Commerce, and more from VMware, Zoom, Fortinet, Siemens, Schneider Electric, and ABB underscore an unrelenting need for rigorous patch management. These releases often address remote code execution, privilege escalation, and exploit chains that can cripple unprepared organizations.

Nissan Leaf Vulnerabilities
Researchers uncovered ways to compromise the infotainment and Bluetooth systems of second-gen Nissan Leafs, potentially tracking the car’s location or manipulating vehicle functions in motion. The automotive sector’s rapid shift toward connectivity demands robust in-vehicle security measures to avoid attacks that endanger driver safety.

Emerging Trends & Policy

“EncryptHub” Researcher Turned Cybercriminal
Known alternately as “SkoricARI” or “Larva208,” this figure toggles between legitimate vulnerability reporting and black-hat exploitation. Microsoft has credited them for Windows zero-day disclosures, even as they use their findings to create malicious tools. The dual nature of such actors complicates threat intelligence and law enforcement efforts.

AI-Fueled Spam (Akira Bot)
The “Akira Bot” leverages machine learning to flood websites with near-humanlike spam that evades CAPTCHAs and basic filters. As AI tools become more refined, defenders must adopt more advanced, behavior-based detection methods to prevent continuous waves of automated spam.

AWS SSRF Exploit Campaign
Threat actors exploit lingering SSRF flaws in Amazon EC2 instances to gather metadata and escalate privileges via compromised IAM credentials. Some vulnerabilities date back to 2017, illustrating how unpatched or overlooked issues persist as prime attack vectors. Attackers can leverage this access to breach S3 storage or disrupt vital services.

Routers Deemed Riskiest Enterprise Device
A Forescout study ranks routers, firewalls, and ADCs as top risk devices due to high exploitability. While endpoints might house more vulnerabilities overall, network gateways are often easier to compromise with severe impact. The findings underline the importance of strict perimeter security, device inventory, and timely patching.

Google’s Emerging AI IDE Competition
Google quietly tests AI-enhanced IDE features in Firebase Studio, rivalling platforms like Cursor AI. While promising for rapid software development, AI-generated code can mask unscanned vulnerabilities. Teams adopting these tools should reinforce code reviews and scanning to catch hidden security pitfalls.

Senator Wyden Blocks CISA Nomination
Sen. Ron Wyden is withholding approval of Sean Planky’s CISA leadership bid pending the release of a 2022 telecom-security report. Critics say the move hampers government readiness, while supporters argue transparency is nonnegotiable. Agencies reliant on CISA guidance brace for potential delays in policy updates.

President Trump Targets Chris Krebs
In an executive order, Trump revoked Chris Krebs’s security clearance and requested an inquiry into alleged free-speech violations during Krebs’s tenure at CISA. Current employer SentinelOne also comes under scrutiny—an event highlighting the rising politicization of cybersecurity roles and possible chilling effects on private-sector collaboration.

Short Action List

• Enforce Strong Authentication
  Implement MFA across critical systems to thwart credential stuffing and reduce identity-based intrusions.

• Refine Incident Response Plans
  Oracle’s and other breaches show that transparent communication and rapid notifications build trust and limit speculation.

• Prioritize Patching
  Target critical bugs first: Apache Parquet (CVE-2025-30065), Ivanti, Android kernel, CrushFTP, and enterprise Patch Tuesday fixes.

• Scrutinize Third-Party Risk
  Evaluate vendors’ disclosure practices (e.g., Oracle, Avanti) and ensure they maintain robust monitoring and patch rollout schedules.

• Audit Vehicle and IoT Security
  Automotive vulnerabilities like Nissan Leaf highlight the need for secure design in connected cars and embedded devices.

• Prepare for AI-Driven Threats
  Emerging spam bots (Akira) and AI coding tools demand advanced behavioral detection and deeper code reviews.

• Monitor Policy Shifts
  Leadership changes at NSA, controversies at CISA, and potential app bans (like TikTok) can reshape compliance and security priorities.

Stay cyber safe